CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 19 Pull requests 15 Wiki Activity Actions

use jtbx SSH key instead of PGP key and use SOPS merge for admin keys
All checks were successful
/ build (pull_request) Successful in 29s
Details
/ Ansible Lint (pull_request) Successful in 5m39s
Details
/ cleanup-staging (pull_request) Successful in 6s
Details
/ build (push) Successful in 25s
Details
/ Ansible Lint (push) Successful in 3m39s
Details

Browse source 
Use jtbx SSH key instead of his PGP key and re-organize .sops.yaml
around the SOPS merge feature to accommodate admin age/SSH keys.
This commit is contained in:
June 2026-09-23 21:46:38 +02:00
commit 4ffb5c18a1
Signed by: june
SSH key fingerprint: SHA256:o9EAq4Y9N9K0pBQeBTqhSDrND5E7oB+60ZNx0U1yPe0
37 changed files with 4617 additions and 4885 deletions
Download patch file Download diff file Expand all files Collapse all files

241
.sops.yaml
View file

@ -1,18 +1,19 @@
keys:
admins:
gpg: &admin_gpg_keys
- &admin_gpg_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
- &admin_gpg_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
- &admin_gpg_jtbx 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
- &admin_gpg_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
- &admin_gpg_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
- &admin_gpg_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
# - &admin_gpg_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
- &admin_gpg_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
- &admin_gpg_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
- &admin_gpg_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
- &admin_gpg_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
- &admin_gpg_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
admins: &admin_keys
pgp: &admin_pgp_keys
- &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
- &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
- &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
- &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
- &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
# - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
- &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
- &admin_pgp_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
- &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
- &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
- &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
age: &admin_age_keys
- &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk
hosts:
chaosknoten:
age: &host_chaosknoten_age_keys
@ -57,222 +58,222 @@ creation_rules:
## group vars
- path_regex: "inventories/chaosknoten/group_vars/.+\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
*host_chaosknoten_age_keys
merge:
- *admin_keys
- path_regex: "inventories/external/group_vars/.+\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
*host_external_age_keys
merge:
- *admin_keys
- path_regex: "inventories/z9/group_vars/.+\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
*host_z9_age_keys
merge:
- *admin_keys
## host vars
# chaosknoten hosts
- path_regex: "inventories/chaosknoten/host_vars/acmedns\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_acmedns_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/cloud\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_cloud_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/jitsi\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_jitsi_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/keycloak\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_keycloak_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/grafana\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_grafana_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/pad\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_pad_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/ccchoir\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_ccchoir_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/pretalx\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_pretalx_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/netbox\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_netbox_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/tickets\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_tickets_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/onlyoffice\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_onlyoffice_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/zammad\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_zammad_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/ntfy\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_ntfy_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/eh22-wiki\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_eh22_wiki_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/sunders\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_sunders_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/wiki\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_wiki_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/renovate\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_renovate_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/lists\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_lists_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/mumble\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_mumble_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/public-reverse-proxy\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_public_reverse_proxy_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/spaceapiccc\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_spaceapiccc_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/draupnir\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_draupnir_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/diday-staging-runner\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_diday_staging_runner_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/auth-dns\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_auth_dns_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/forgejo-runner\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_forgejo_runner_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/chaosknoten/host_vars/forgejo-runner-external\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_forgejo_runner_external_ansible_pull_age_key
merge:
- *admin_keys
# external hosts
- path_regex: "inventories/external/host_vars/status\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_status_ansible_pull_age_key
merge:
- *admin_keys
# z9 hosts
- path_regex: "inventories/z9/host_vars/dooris\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_dooris_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/z9/host_vars/light\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_light_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/z9/host_vars/waybackproxy\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_waybackproxy_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/z9/host_vars/yate\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_yate_ansible_pull_age_key
merge:
- *admin_keys
- path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+"
key_groups:
- pgp:
*admin_gpg_keys
age:
- age:
- *host_z9_router_ansible_pull_age_key
merge:
- *admin_keys
# general
- path_regex: ".+\\.sops\\..+"
key_groups:
- pgp: *admin_gpg_keys
- *admin_keys
stores:
yaml: